Remote buffer overflow vulnerability in noip2 2.1.7

[Joril]

Binary package hint: noip2

> No-IP Dynamic Update Client (DUC) is prone to a stack-based buffer-overflow vulnerability because it fails to adequately
> bounds-check input messages.
> An attacker can exploit this issue by enticing an unsuspecting user into connecting to a malicious server. Successful attacks will
> allow arbitrary code to run within the context of the affected application. Failed exploit attempts will result in a denial-of-service
> condition.
> DUC 2.1.7 for Linux is vulnerable; other versions may also be affected.

Source: http://www.securityfocus.com/bid/32344

No-ip.com published version 2.1.8 at http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz

Thanks!

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityUpdateProcedures

[Joril (jorilx)]

For the record, I tried to use the 2.1.9 package for Jaunty on Hardy, and it works.

[Jason Ribeiro (jrib)]

This has been fixed. Current version in maverick is 2.1.9